CVE-2026-106441: CWE-94: Improper Control of Generation of Code ('Code Injection') in hydra-ecosystem hydra

Hydra versions before 1.3.6 and from 1.4.0.dev0 up to but not including 1.4.0.dev9 pass Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. This flaw enables an attacker who can control Hydra logging configuration to select an importable class or factory and cause it to be invoked with the application's privileges, effectively leading to code injection. The vulnerability is addressed in versions 1.3.6 and 1.4.0.dev9.

An attacker with the ability to control Hydra logging configuration can execute arbitrary code with the application's privileges, potentially leading to full compromise of the affected system. The vulnerability has a CVSS 3.1 score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.

Upgrade to hydra versions 1.3.6 or later, or 1.4.0.dev9 or later, where this vulnerability is fixed. There are no known mitigations other than applying the official fix. Patch status is confirmed fixed in these versions.